관리-도구
편집 파일: dnssec.pyc
� ��Sc @ s: d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d e j j f d � � YZ d e j j f d � � YZ d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z i e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d! 6e d" 6Z e g e j! � D] \ Z" Z# e# e" f ^ q�� Z$ d# � Z% d$ � Z& d% � Z' d d& � Z) d d' � Z* d( � Z+ d) � Z, d* � Z- d+ � Z. d, � Z/ d- � Z0 d. � Z1 d/ � Z2 d0 � Z3 d1 � Z4 d2 � Z5 d d d3 � Z6 d d d4 � Z7 d5 � Z8 y: d d l9 Z: d d l; Z: d d l< Z: e7 Z= e6 Z> e? Z@ Wn# eA k r�e8 Z= e8 Z> eB Z@ n XyP d d lC ZC d d lD ZC d d lE ZC d d lF ZC e? ZG d6 eH f d7 � � YZI Wn eA k r5eB ZG n Xd S(8 s. Common DNSSEC-related functions and constants.i����Nt UnsupportedAlgorithmc B s e Z d Z RS( s( Raised if an algorithm is not supported.( t __name__t __module__t __doc__( ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyR s t ValidationFailurec B s e Z d Z RS( s The DNSSEC signature is invalid.( R R R ( ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyR # s i i i i i i i i i i i i� i� i� t RSAMD5t DHt DSAt ECCt RSASHA1t DSANSEC3SHA1t RSASHA1NSEC3SHA1t RSASHA256t RSASHA512t INDIRECTt ECDSAP256SHA256t ECDSAP384SHA384t PRIVATEDNSt PRIVATEOIDc C s4 t j | j � � } | d k r0 t | � } n | S( s: Convert text into a DNSSEC algorithm value @rtype: intN( t _algorithm_by_textt gett uppert Nonet int( t textt value( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt algorithm_from_textM s c C s. t j | � } | d k r* t | � } n | S( s; Convert a DNSSEC algorithm value to text @rtype: stringN( t _algorithm_by_valueR R t str( R R ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt algorithm_to_textV s c C s) t j � } | j | d | �| j � S( Nt origin( t cStringIOt StringIOt to_wiret getvalue( t recordR t s( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _to_rdata_ s c C s� t | | � } | j t k r> t | d � d >t | d � Sd } xP t t | � d � D]8 } | t | d | � d >t | d | d � 7} q[ Wt | � d d k r� | t | t | � d � d >7} n | | d ?d @7} | d @Sd S( Ni����i i����i i i i i�� ( R% t algorithmR t ordt ranget len( t keyR t rdatat totalt i( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt key_idd s 6%c C s( | j � d k r0 d } t j j d � � } n= | j � d k r` d } t j j d � � } n t d | � t | t t f � r� t j j | | � } n | j | j � j � � | j t | | � � | j � } t j d t | � | j | � | } t j j t j j t j j | d t | � � S( Nt SHA1i t SHA256i s unsupported algorithm "%s"s !HBBi ( R t dnst hashR R t isinstanceR t unicodet namet from_textt updatet canonicalizeR! R% t digestt structt packR. R& R+ t from_wiret rdataclasst INt rdatatypet DSR) ( R5 R* R& R t dsalgR2 R9 t dsrdata( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt make_dsq s %!c C s� g } | j | j � } | d k r( d St | t j j � rw y" | j t j j t j j � } Wq} t k rs d SXn | } xE | D]= } | j | j k r� t | � | j k r� | j | � q� q� W| S( N( R t signerR R3 R1 t nodet Nodet find_rdatasetR= R> R? t DNSKEYt KeyErrorR& R. t key_tagt append( t keyst rrsigt candidate_keysR t rdatasetR+ ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _find_candidate_keys� s c C s | t t t t t f k S( N( R R R R R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _is_rsa� s c C s | t t f k S( N( R R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _is_dsa� s c C s t o | t t f k S( N( t _have_ecdsaR R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _is_ecdsa� s c C s | t k S( N( R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _is_md5� s c C s | t t t t f k S( N( R R R R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _is_sha1� s c C s | t t f k S( N( R R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _is_sha256� s c C s | t k S( N( R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _is_sha384� s c C s | t k S( N( R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _is_sha512� s c C s� t | � r t j j d � � St | � r> t j j d � � St | � r] t j j d � � St | � r| t j j d � � St | � r� t j j d � � St d | � d S( Nt MD5R/ R0 t SHA384t SHA512s unknown hash for algorithm %u( RU R1 R2 R RV RW RX RY R ( R& ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _make_hash� s c C s7 t | � r- d d d d d d d d g } n� t | � rQ d d d d d g } nm t | � r� d d d d d d d d d g } n= t | � r� d d d d d d d d d g } n t d | � t | � } t | � j } d g d | | g d | d g d | g | d d g d | g } d j t t | � � S( Ni* i� iH i� i i i i+ i i i i` i ie i s unknown algorithm %ui0 i i i t ( RU RV RW RY R R) R] t digest_sizet joint mapt chr( R& t oidt olent dlent idbytes( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _make_algorithm_id� s ! $ $ Hc * C s� t | t t f � r3 t j j | t j j � } n xXt | | � D]G} | s[ t d � n t | t � r� | d } | d } n | j } | } | d k r� t j � } n | j | k r� t d � n | j | k r� t d � n t | j � } t | j � r�| j } t j d | d d !� \ } | d } | d k rct j d | d d !� \ } | d } n | d | !} | | } t | � d } t j j j t j j j | � t j j j | � f � } t j j j | j � f } n�t | j � r(| j } t j d | d d !� \ } | d } d | d } | d d !} | d } | d | !} | | } | d | !} | | } | d | !} t j j j t j j j | � t j j j | � t j j j | � t j j j | � f � } t j d | j d � \ } } t j j j | � t j j j | � f } nzt | j � r�| j t k rat! j" j# } d } d } n3 | j t$ k r�t! j" j% } d } d } n t d � | j } t j j j | d | !� } t j j j | | | d !� } t! j! j& | j' | | � s�t( � t! j) j* | j+ | | | j, � } t! j- j. j/ | | � } t0 | | � } | j | } | j | } t! j! j1 t j j j | � t j j j | � � } n t d | j � | j2 t3 | | � d � | j2 | j4 j5 | � � | j6 t | � d k r | j7 | j6 d � d }! t j j d |! � } n | j5 | � }" t j8 d | j9 | j: | j; � }# t< | � }$ xi |$ D]a }% | j2 |" � | j2 |# � |% j5 | � }& t j8 d t |& � � }' | j2 |' � | j2 |& � qcW| j= � }( t | j � rCt> | j � |( }( | d t |( � d }) t? d � t? d � t? d � |) t? d � |( }( n1 t | j � stt | j � rdn t d | j � | j@ |( | � rC d SqC Wt d � d S( s� Validate an RRset against a single signature rdata The owner name of the rrsig is assumed to be the same as the owner name of the rrset. @param rrset: The RRset to validate @type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset) tuple @param rrsig: The signature rdata @type rrsig: dns.rrset.Rdata @param keys: The key dictionary. @type keys: a dictionary keyed by dns.name.Name with node or rdataset values @param origin: The origin to use for relative names @type origin: dns.name.Name or None @param now: The time to use when validating the signatures. The default is the current time. @type now: int s unknown keyi i t expireds not yet valids !Bs !Hi i i@ i s !20s20si i0 s unknown ECDSA curves unknown algorithm %ui t *s !HHIi i� Ns verify failure(A R3 R R4 R1 R5 R6 t rootRP R t tupleR t timet expirationt inceptionR] R& RQ R* R: t unpackR) t Cryptot PublicKeyt RSAt constructt Utilt numbert bytes_to_longt signatureRR R RT R t ecdsat curvest NIST256pR t NIST384pt point_is_validt generatort AssertionErrort ellipticcurvet Pointt curvet orderRL t VerifyingKeyt from_public_pointt ECKeyWrappert SignatureR7 R% RD t to_digestablet labelst splitR; t rdtypet rdclasst original_ttlt sortedR9 Rg Rb t verify(* t rrsetRM RL R t nowt candidate_keyt rrnameRO R2 t keyptrt bytest rsa_et rsa_nt keylent pubkeyt sigt tt octetst dsa_qt dsa_pt dsa_gt dsa_yt dsa_rt dsa_sR� t key_lent digest_lent xt yt pointt verifying_keyt rR$ t suffixt rrnamebuft rrfixedt rrlistt rrt rrdatat rrlenR9 t padlen( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _validate_rrsig� s� !! 5 c C s t | t t f � r3 t j j | t j j � } n t | t � rO | d } n | j } t | t � r~ | d } | d } n | j } | } | j | � } | j | � } | | k r� t d � n xB | D]: } y t | | | | | � d SWq� t k r} q� Xq� Wt d � d S( sd Validate an RRset @param rrset: The RRset to validate @type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset) tuple @param rrsigset: The signature RRset @type rrsigset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset) tuple @param keys: The key dictionary. @type keys: a dictionary keyed by dns.name.Name with node or rdataset values @param origin: The origin to use for relative names @type origin: dns.name.Name or None @param now: The time to use when validating the signatures. The default is the current time. @type now: int i i s owner names do not matchNs no RRSIGs validated( R3 R R4 R1 R5 R6 Rj Rk t choose_relativityR R� ( R� t rrsigsetRL R R� R� t rrsignamet rrsigrdatasetRM t e( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _validatea s* c O s t d � d S( Ns# DNSSEC validation requires pycrypto( t NotImplementedError( t argst kwargs( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt _need_pycrypto� s R� c B s e Z d � Z d � Z RS( c C s | | _ | | _ d S( N( R* R� ( t selfR* R� ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt __init__� s c C s+ t j j j | � } | j j j | | � S( N( Rp Rt Ru Rv R* R� t verifies( R� R9 R� t diglong( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyR� � s ( R R R� R� ( ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyR� � s (J R R R: Rl t dns.exceptionR1 t dns.hasht dns.namet dns.nodet dns.rdatasett dns.rdatat dns.rdatatypet dns.rdataclasst exceptiont DNSExceptionR R R R R R R R R R R R R R R R R t dictt iteritemsR� R� R R R R% R R. RC RP RQ RR RT RU RV RW RX RY R] Rg R� R� R� t Crypto.PublicKey.RSARp t Crypto.PublicKey.DSAt Crypto.Util.numbert validatet validate_rrsigt Truet _have_pycryptot ImportErrort FalseRx t ecdsa.ecdsat ecdsa.ellipticcurvet ecdsa.keysRS t objectR� ( ( ( s0 /usr/lib64/python2.7/site-packages/dns/dnssec.pyt <module> s� 1 �.